chore(objectos): bump @objectstack 10.2 → 12.1 so the runtime image ships latest

apps/objectos/objectstack.config.ts

@@ -46,8 +46,19 @@ const environmentId =
 const databaseUrl =
   process.env.OS_BUSINESS_DB_URL ?? process.env.OS_DATABASE_URL;
 
-export default await createStandaloneStack({
+const stack = await createStandaloneStack({
   artifactPath: artifactFile,
   environmentId,
   databaseUrl,
 });
+
+// @objectstack 12.1 workaround: createStandaloneStack hard-codes
+// `api.projectResolution: 'none'` for the single-tenant standalone case, but the
+// 12.1 protocol validator's `api.projectResolution` enum only accepts
+// required|optional|auto (the field is optional). Since standalone runs with
+// `enableProjectScoping: false`, drop the field so compile/validate passes.
+const { projectResolution: _drop, ...api } = stack.api as {
+  projectResolution?: string;
+} & Record<string, unknown>;
+
+export default { ...stack, api };

apps/objectos/package.json

@@ -13,16 +13,16 @@
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
-    "@objectstack/cli": "^10.2.0",
-    "@objectstack/cloud-connection": "^10.2.0",
-    "@objectstack/console": "^10.2.0",
-    "@objectstack/core": "^10.2.0",
-    "@objectstack/driver-memory": "^10.2.0",
-    "@objectstack/driver-sql": "^10.2.0",
-    "@objectstack/metadata": "^10.2.0",
-    "@objectstack/objectql": "^10.2.0",
-    "@objectstack/runtime": "^10.2.0",
-    "@objectstack/spec": "^10.2.0",
+    "@objectstack/cli": "^12.1.0",
+    "@objectstack/cloud-connection": "^12.1.0",
+    "@objectstack/console": "^12.1.0",
+    "@objectstack/core": "^12.1.0",
+    "@objectstack/driver-memory": "^12.1.0",
+    "@objectstack/driver-sql": "^12.1.0",
+    "@objectstack/metadata": "^12.1.0",
+    "@objectstack/objectql": "^12.1.0",
+    "@objectstack/runtime": "^12.1.0",
+    "@objectstack/spec": "^12.1.0",
     "pg": "^8.0.0"
   },
   "devDependencies": {

docker/docker-compose.yml

@@ -1,3 +1,16 @@
+# ===========================================================================
+# ⚠️  REQUIRED in production (image runs with NODE_ENV=production):
+#     - OS_SECRET_KEY  : 32-byte hex, stable across restarts/nodes. Without it
+#                        the container REFUSES TO START (LocalCryptoProvider
+#                        guards sys_secret / datasource credentials). It is NOT
+#                        auto-generated on purpose — a minted-then-lost key would
+#                        make every encrypted value undecryptable.
+#     - OS_AUTH_SECRET : session signing secret; plugin-auth refuses a temporary
+#                        dev secret in production.
+#     Generate each once and keep them:  openssl rand -hex 32
+#     Set them in a .env file next to this compose (or export in the shell):
+#         OS_SECRET_KEY=...   OS_AUTH_SECRET=...
+# ===========================================================================
 services:
   objectos:
     build:
@@ -13,8 +26,8 @@ services:
       OS_PROJECT_ID: ${OS_PROJECT_ID:-}
       OS_ARTIFACT_FILE: ${OS_ARTIFACT_FILE:-/artifacts/objectstack.json}
       OS_BUSINESS_DB_URL: ${OS_BUSINESS_DB_URL:-file:/var/lib/objectos/data.db}
-      OS_SECRET_KEY: ${OS_SECRET_KEY:-}
-      OS_AUTH_SECRET: ${OS_AUTH_SECRET:-}
+      OS_SECRET_KEY: ${OS_SECRET_KEY:-}     # REQUIRED — empty = container won't boot (see header)
+      OS_AUTH_SECRET: ${OS_AUTH_SECRET:-}   # REQUIRED in production (see header)
       OS_CORS_ORIGIN: ${OS_CORS_ORIGIN:-}
       OS_CACHE_DIR: /var/cache/objectos
       PORT: 3000